Enhance ObjectSerializer to support real-world user types beyond WorkflowCore namespaces

Co-authored-by: danielgerlag <2357007+danielgerlag@users.noreply.github.com>

Author: Copilot

src/providers/WorkflowCore.Persistence.MongoDB/Services/MongoPersistenceProvider.cs

@@ -27,11 +27,30 @@ public MongoPersistenceProvider(IMongoDatabase database)
 
         static MongoPersistenceProvider()
         {
-            // Register ObjectSerializer to allow deserialization of WorkflowCore types and user types
-            // This matches the pattern used in MongoDB tests which resolves serialization issues
+            // Register ObjectSerializer to allow deserialization of user types while maintaining security
+            // Allows all default types plus user-defined types (excluding system/framework types)
             BsonSerializer.TryRegisterSerializer(new ObjectSerializer(type =>
-                ObjectSerializer.DefaultAllowedTypes(type) || 
-                type.FullName?.StartsWith("WorkflowCore") == true));
+            {
+                // Allow all default MongoDB allowed types (primitives, collections, etc.)
+                if (ObjectSerializer.DefaultAllowedTypes(type))
+                    return true;
+                    
+                // Allow WorkflowCore types (for backward compatibility)
+                if (type.FullName?.StartsWith("WorkflowCore") == true)
+                    return true;
+                    
+                // Allow user types by excluding system/framework types
+                // This prevents security issues while allowing user data classes
+                var fullName = type.FullName ?? "";
+                if (fullName.StartsWith("System.") ||
+                    fullName.StartsWith("Microsoft.") ||
+                    fullName.StartsWith("System,") ||
+                    fullName.StartsWith("Microsoft,"))
+                    return false;
+                    
+                // Allow all other types (user-defined types)
+                return true;
+            }));
 
             ConventionRegistry.Register(
                 "workflow.conventions",